Docs

One free scan

You can run one health check before you pay. Open /scan, add a public URL you own, and say how you control it. No account is required for that first result. The check runs Security, CrawlProof, and ModelSunset.

The free check is one scan per browser. On the live site it is also one per network, so it cannot be used as an open scanner. A failed try can be repeated, up to three tries in a day.

See your first health check free. Upgrade when you want ongoing Security + CrawlProof + ModelSunset. Run one free scan. Then run checks whenever you want with Solo $29 or Pro $49.

Solo is $29 a month for 1 site. Pro is $49 a month for up to 5 sites. After you upgrade, the next scans wait until the Stripe webhook marks the plan active. Checkout uses the Solo and Pro prices already set on the server.

Ownership gate

Before a scan, you write how you own the URL and tick a box that says you own or control it and may test it. We store that note with the scan. We do not publish results, and we do not offer a public page that shames other people's sites. Verification is not required yet. If your homepage has a meta tag named howistheapp-verification, or your domain has a DNS TXT record that starts with howistheapp-verify=, we mark the scan as verified. Otherwise it is marked as attested only. Private network addresses are always blocked.

Security

Loads the public page with no login cookie. It checks common security headers, server banners, rate-limit headers, and obvious secret-like strings in scripts. It cannot see your database or a signed-in session.

CrawlProof

Parses robots.txt per bot (Googlebot, GPTBot, ClaudeBot, and more), validates sitemap XML and sample URLs, checks SEO meta, Open Graph, JSON-LD, favicon, and X-Robots-Tag. Missing or blocked items lower the score.

ModelSunset

Reads your homepage and a limited number of its public scripts from the same site. It looks for AI model names that a provider has retired or plans to retire (OpenAI, Anthropic, Google, Cohere), old AI endpoints, and which AI providers your public code talks to. Each hit shows the shutdown date and a newer model to move to. You can also upload your own package.json to check AI SDK versions. That file stays in the scan request. We do not clone a private repo. Server-only code is not visible from outside, so a clean result does not prove your server is clean. Only retired or deprecated items lower the score. Modern SDKs show up as passed checks.